1. Field
The present inventive concept pertains to a system and method to visualize overlapping events related to and possibly affecting computer software. The present inventive concept more particularly concerns a system and method to visualize user sessions.
2. Discussion of Related Art
A thorough investigation of software problems such as security breaches or execution of malware often involves analysis of a multitude of software-related events. These events can be recorded in association with one or more specific times or “timestamps” that may relate to when certain aspects of the event, the event itself, or other system changes occurred. For example, some events can be associated with a single specific time while others extend or persist over a period of time and thus may be associated with multiple recorded times. An example of an event that extends over a period of time is a user logon session. Currently, because investigators lack adequate tools, events extending over a period of time are not readily apparent to the investigators and may be overlooked, which may result in flawed investigation results, particularly if the event in question is critical.
Thus, there is a need for a system and method to present information to an investigator in a more persistent context so that an investigator's ability to perceive and make decisions based on correlating individual events and persistent context is improved.